I'm going to go with the 'it depends' answer, but with slightly different thoughts on it than 5mi11er --

Why do I want the data subset?

If I'm removing problem data, and I don't want anything else that might act on the data to see the problem items, then I'll remove them, rather than making a copy. If it's just a reduction for the task at hand, but something else is going to need the whole data set, then I'm going to work on a copy.

Why was this hash created?

If it was created just for the task and hand, or I'm not going to need it for anything else once I'm done (the program will terminate, etc), I'll trim it down to the entries I care about, rather than keeping it in memory, with a copy of the trimmed down version.

Am I in a function?

If the hash was passed in as a reference to a function, unless the function is specifically named in such a way as to suggest that it's modifying its arguments (eg, 'remove_invalid_values'), I'm going to make a copy, as I have no idea how people might chain things together later. Typically, if I'm in a function, I'll just return out the copied hashref, so that the code calling the function can decide if they want to trash the original:$hashref = valid_values( $hashref );

As for a rule of thumb -- given a choice between destroy, and not destroying, I'm going to get rid of stuff that I don't need anymore as quickly as possible.

You can, however, run into problems -- when you wrote the code, it was the last thing in the program... but someone went and added something new at the bottom, and can't understand why the values they wanted are now missing.